The Linux kernel's s390/zcrypt subsystem contained a vulnerability where user-controlled length fields in CCA token structures were not properly validated against the actual buffer size and minimum token structure size. This allowed attackers to specify length fields larger than the buffer, causing buffer over-read, or very small length values, causing buffer underflow. Such conditions could result in kernel crashes or memory disclosure by reading beyond buffer boundaries. The fix involves validating that the key buffer length is at least the size of the token structure and that the token length field fits within the valid range between the token structure size and the key buffer length.

An attacker could exploit this vulnerability to cause a denial of service via kernel crash or potentially expose sensitive kernel memory contents. The impact is limited to systems using the s390/zcrypt component of the Linux kernel. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to validate buffer sizes and token length fields properly, preventing buffer over-read and underflow. Users should update to the fixed kernel version once available. Patch status is not yet confirmed in the provided data; check the Linux kernel vendor advisory for current remediation guidance.